W95.SoFunny - Love.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W95.SoFunny

Sender:

Varies.

Subject:

Fwd: This is great! =)
Fwd: This is hilarious! =)

Message:

NA

Attachment:

Love.exe
Sofunny.exe

Comments: A password-stealing Trojan horse that targets AOL users and has worm capabilities.

Symptoms:


 It copies itself as WindowsMsdos423.exe. 
 To enable itself to run at startup, it adds the value msdos423
msdos423.exe to the registry key
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun 
 It drops the text file WindowsMsdos423.ini to mark its presence. The
Msdos423.ini file contains the following strings: [Setup] and
Copied=True 
 First time it is run, will display message saying "An unknown error
has occurred."

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Run LiveUpdate to make sure that you have the most recent virus definitions.
NOTE: You must have virus definitions dated July 3. 2001 or later for NAV to remove this worm. If you cannot connect to the Internet, and are unable to run LiveUpdate and obtain these definitions, you will have to remove the worm manually. In this case, skip to the section Manual removal instructions.
Start Norton AntiVirus (NAV), and run a full system scan, making sure that NAV is set to scan all files.
Delete any files detected as W95.SoFunny.Worm@m. What you do next depends on whether NAV was able to delete files that it detected as infected with W95.SoFunny.Worm@m: